CVE-2026-91405

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In PDF Export SDK. The supported version that is affected is 8.5.8. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside...

CVE-2026-91460

A vulnerability exists in the Outside In Image Export SDK component of the Oracle Outside In Technology product within Oracle Fusion Middleware (version 8.5.8 ). This easily exploitable flaw allows an unauthenticated attacker with access to the infrastructure to compromise the product, potentiall...

CVE-2026-91457

A vulnerability exists in the Outside In Image Export SDK component of the Oracle Outside In Technology product (part of Oracle Fusion Middleware), specifically affecting version 8.5.8 . An unauthenticated attacker with access to the infrastructure can compromise the product, potentially leading ...

CVE-2026-91459

The Oracle Outside In Technology product, specifically within the Oracle Fusion Middleware (component: Outside In Image Export SDK ), is affected by CVE-2026-91459 in version 8.5.8 . An unauthenticated attacker with logon access to the infrastructure where the software executes can compromise the...

CVE-2026-91405

A vulnerability exists in the Outside In PDF Export SDK component of the Oracle Outside In Technology product within Oracle Fusion Middleware . This issue affects version 8.5.8 . An unauthenticated attacker with network access via HTTP can exploit this difficult-to-execute vulnerability to compro...

CVE-2026-91406

A vulnerability exists in the Outside In PDF Export SDK component of the Oracle Outside In Technology product within Oracle Fusion Middleware (affected version 8.5.8 ). An unauthenticated attacker with network access via HTTP can exploit this high-complexity vulnerability to compromise or take ov...

CVE-2026-91404

A vulnerability exists in the Outside In PDF Export SDK component of the Oracle Outside In Technology product (part of Oracle Fusion Middleware). The affected supported version is 8.5.8 . An unauthenticated attacker with local access to the infrastructure where the software executes can easily ex...

CLSA-2026-1792530394 TuxCare security update for @babel/helper-split-export-declaration (2 CVEs)

TuxCare rebuilt @babel/helper-split-export-declaration to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792530389 TuxCare security update for @babel/helper-split-export-declaration (1 CVE)

TuxCare rebuilt @babel/helper-split-export-declaration to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792530388 TuxCare security update for @babel/helper-split-export-declaration (1 CVE)

TuxCare rebuilt @babel/helper-split-export-declaration to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792530387 TuxCare security update for @babel/helper-split-export-declaration (1 CVE)

TuxCare rebuilt @babel/helper-split-export-declaration to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

CLSA-2026-1792525290 TuxCare security update for @babel/plugin-proposal-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 1 CVE. Fixed in 7.18.9-tuxcare.3...

CLSA-2026-1792525288 TuxCare security update for @babel/plugin-proposal-export-default-from (2 CVEs)

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...

CLSA-2026-1792525287 TuxCare security update for @babel/plugin-proposal-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 1 CVE. Fixed in 7.21.0-tuxcare.4...

CLSA-2026-1792525284 TuxCare security update for @babel/plugin-proposal-export-default-from (1 CVE)

TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 1 CVE. Fixed in 7.21.5-tuxcare.1...

ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test

Summary The tar-extraction guard added to @apostrophecms/import-export for GHSA-mwxc-m426-3f78 is a literal substring test for ../, and ./.. does not contain that substring. An entry named ./.. therefore passes the guard, path.join normalizes it to the parent of the export directory, and the...

ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

Summary @apostrophecms/import-export's update-by-key feature lets an imported document carry a :key property for example slug:key whose value is used to find an existing document to update instead of inserting a new one. getUpdateKey/insertOrUpdateDocWithKey lib/methods/import.js use that value...

GHSA-JQW5-W6H3-44G6 ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document

Summary @apostrophecms/import-export's update-by-key feature lets an imported document carry a :key property for example slug:key whose value is used to find an existing document to update instead of inserting a new one. getUpdateKey/insertOrUpdateDocWithKey lib/methods/import.js use that value...

CVE-2026-113711

ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 3.7.0 of the import-export module, import routes invoke bigUploadMiddleware without an early authorize callback, allowing unauthenticated requests to perform upload initialization, chunk storag...

CVE-2026-113664

ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a wri...